The customer has a FreeNAS 9.3 system with 3x3TB hard drives in RAIDZ1 configuration.

Problem:

A share holding 2TB of data was deleted from the system. The last backup of the share was 2 years old.
The customer needed to recover digital photos (CR2s, JPGs, TIFs, ...) created or modified in the last 2 years.
File names and folder structure were not important.

Solution:

We came up with the following procedure to recover the deleted data:

Scanned the drives for FSO (File System Object) dnodes.

Filtered out file system dnodes, intermediate dnodes (ZFS uses Copy-On-Write.
As a result, multiple dnodes are created when a file is created or modified), and files with modified date older than 2 years ago.

Used the info in the dnode to read the header of the files.

Used the header to filter our irrelevant files and recovered only digital photos.